From 2daae5fd11344eaa88a0d92b0f6d65f8d2255c00 Mon Sep 17 00:00:00 2001
From: Ben Murdoch <benm@google.com>
Date: Thu, 2 Jun 2011 12:07:03 +0100
Subject: Merge WebKit at r84325: Initial merge by git.

Change-Id: Ic1a909300ecc0a13ddc6b4e784371d2ac6e3d59b
---
 Source/WebCore/rendering/RenderObjectChildList.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'Source/WebCore/rendering/RenderObjectChildList.cpp')

diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index 617067a..e26f221 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -456,6 +456,12 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                 ASSERT(styledObject->node()); // The styled object cannot be anonymous or else it could not have ':before' or ':after' pseudo elements.
                 generatedContentContainer->setNode(styledObject->node()); // This allows access to the generatingNode.
                 generatedContentContainer->setStyle(pseudoElementStyle);
+                if (!owner->isChildAllowed(generatedContentContainer, pseudoElementStyle)) {
+                    // The generated content container is not allowed here -> abort.
+                    generatedContentContainer->destroy();
+                    renderer->destroy();
+                    return;
+                }
                 owner->addChild(generatedContentContainer, insertBefore);
             }
             if (generatedContentContainer->isChildAllowed(renderer, pseudoElementStyle))
-- 
cgit v1.1